Handle user sign up / forgot passwords / etc

[mlissner]

We'll need:

• Sign in
  • Ideally, this uses the email address, not the username, since that regularly trips people up, but I know Django prefers usernames, so if it's hard, fine.
• Register
  • CL has a lot of tweaks on this that are worth reviewing, ignoring the stub_account stuff.
• Confirm email
• Forgot password
  • Should always respond with a message saying that information has been sent, but not indicating whether the account exists.
  • If the account does not exist, we send a message to the email saying so. This should help confused people.
  • If the account does exist, we send an email to help them fix things.

---

A few high-level security things:

• Nothing should reveal whether somebody has an account with bots.law unless they control the email for the account.
• We should use @sensitive_variables and @sensitive_post_parameters on all functions we create here.
• We should add rate-limiting wherever needed in this section of the code.
• Anybody can sign up, I guess, but it won't get them very far until the Chat Bots are ready or we allow people to create their own Little bots. Until then, we'll just tell people to sign up, then we'll give them permission for particular channels by hand.